[PATCH 3/3] submodule-config.c: strengthen URL fsck check
- From
Victoria Dye via GitGitGadget <gitgitgadget@gmail.com>
- Date
- Jan 9, 2024, 17:53 UTC
- Message-ID
- <893071530d3b77d6b72b7f69a6dfb9947579865e.1704822817.git.gitgitgadget@gmail.com>
- In-Reply-To
- <pull.1635.git.1704822817.gitgitgadget@gmail.com>
From: Victoria Dye <vdye@github.com>
Update the validation of "curl URL" submodule URLs (i.e. those that specify an "http[s]" or "ftp[s]" protocol) in 'check_submodule_url()' to catch more invalid URLs. The existing validation using 'credential_from_url_gently()' parses certain URLs incorrectly, leading to invalid submodule URLs passing 'git fsck' checks. Conversely, 'url_normalize()' - used to validate remote URLs in 'remote_get()' - correctly identifies the invalid URLs missed by 'credential_from_url_gently()'.
To catch more invalid cases, replace 'credential_from_url_gently()' with 'url_normalize()' followed by a 'url_decode()' and a check for newlines (mirroring 'check_url_component()' in the 'credential_from_url_gently()' validation).
Signed-off-by: Victoria Dye <vdye@github.com> --- submodule-config.c | 16 +++++++++++----- t/t7450-bad-git-dotfiles.sh | 2 +- 2 files changed, 12 insertions(+), 6 deletions(-)
diff --git a/submodule-config.c b/submodule-config.c index 3b295e9f89c..54130f6a385 100644 --- a/submodule-config.c +++ b/submodule-config.c @@ -15,7 +15,7 @@ #include "thread-utils.h" #include "tree-walk.h" #include "url.h" -#include "credential.h" +#include "urlmatch.h" /* * submodule cache lookup structure @@ -350,12 +350,18 @@ int check_submodule_url(const char *url) } else if (url_to_curl_url(url, &curl_url)) { - struct credential c = CREDENTIAL_INIT; int ret = 0; - if (credential_from_url_gently(&c, curl_url, 1) || - !*c.host) + char *normalized = url_normalize(curl_url, NULL); + if (normalized) { + char *decoded = url_decode(normalized); + if (strchr(decoded, '\n')) + ret = -1; + free(normalized); + free(decoded); + } else { ret = -1; - credential_clear(&c); + } + return ret; } diff --git a/t/t7450-bad-git-dotfiles.sh b/t/t7450-bad-git-dotfiles.sh index 0dbf13724f4..46d4fb0354b 100755 --- a/t/t7450-bad-git-dotfiles.sh +++ b/t/t7450-bad-git-dotfiles.sh @@ -45,7 +45,7 @@ test_expect_success 'check names' ' test_cmp expect actual ' -test_expect_failure 'check urls' ' +test_expect_success 'check urls' ' cat >expect <<-\EOF && ./bar/baz/foo.git https://example.com/foo.git
-- gitgitgadget